Exclude sending alerts when specific texts occur in logs

[cask]

There is a server that runs one windows service which starts multiple scheduled jam jobs. Currently, the alerts are coming from the Jams tool that runs the jobs so the team wants to leverage Dynatrace so that they can control certain scenarios when to get alerts and the actions (this can’t be done in their tool). Currently, whenever there is an error, the team gets alerted multiple times at different times of the day so those are really noisy.

Here is a simple query for one of the logs.

fetch logs
| filter matchesValue(log.source, "C:\\temp\\ServiceLog.ProductCorrelation-Production-FileParser.CorrelationFileParser.txt") and matchesValue(dt.entity.host, "HOST-B0231FBA429B721D")

This is what they want to do:

They want alerts to be trigger when errors are showing for these jobs but with one exception.
EXCLUDE sending alerts when specific text shows up in the logs. System.InvalidOperationException: Collection was modified; enumeration operation may not execute.

[marina_pollehn · Accepted solution]

You can add another filter to your query.

fetch logs
| filter matchesValue(log.source, "C:\\temp\\ServiceLog.ProductCorrelation-Production-FileParser.CorrelationFileParser.txt") and matchesValue(dt.entity.host, "HOST-B0231FBA429B721D")

| filter not matchesPhrase(content, "System.InvalidOperationException: Collection was modified; enumeration operation may not execute.")